Healthcare Compliance Programs Not In Line With Expectations of Regulators

Healthcare compliance officers are prioritizing compliance with HIPAA Privacy and Security Rules, even though the majority of Department of Justice and the HHS Office of Inspector General enforcement actions are not for violations of HIPAA or security breaches, but corrupt arrangements with referral sources and false claims. There are more penalties issued by regulators for these two compliance failures than penalties for HIPAA violations.

HIPAA enforcement by the HHS’ Office for Civil Rights has increased, yet the liabilities to healthcare organizations from corrupt arrangements with referral sources and false claims are far higher. Even so, these aspects of compliance are relatively low down the list of priorities, according to a recent survey of 388 healthcare professionals conducted by SAI Global and Strategic Management Services.

The survey was conducted on compliance officers from healthcare organizations of all sizes, from small physician practices to large integrated hospital systems. The aim of the study was to identify the key issues faced by compliance officers and determine how compliance departments are responding and prioritizing their resources.

When asked to rank their main priorities, dealing with HIPAA data breaches was overwhelmingly the top priority and the biggest concerns were HIPAA privacy and security.

The list of HIPAA enforcement actions has grown considerably over the past two years but there are still fewer penalties than for false claims and arrangements with referral sources. Even so, ensuring claims accuracy was only ranked third in compliance officers’ priority list and arrangement with referral sources was ranked fifth. The survey shows there is a gap between what OIG and DOJ consider to be the highest risk areas and where compliance officers see the greatest risks.

“The question has to be asked as to why, in the face the enforcement agencies’ priorities, compliance officers are placing these high risk-areas in a lower priority,” said former HHS Inspector General and CEO of Strategic Management Services Richard Kusserow. “The takeaway from the survey is that compliance officers should be prepared to better align their priorities and programs with those set out by the regulatory and enforcement agencies.”

Part of the reason for the focus on HIPAA compliance is the increase in enforcement activity by OCR in the past two years, the media activity surrounding healthcare data breaches, and the relatively high fines for covered entities discovered not to have fully complied with HIPAA Rules. With OCR investigating all breaches of more than 500 records, and data breaches now occurring with increasing frequency, it is easy to see why HIPAA compliance is being prioritized.

Even though HIPAA is the main priority for compliance officers and where most resources are focused, only one in five compliance officers feels their organization is well prepared for a HIPAA compliance audit. Last year when the survey was conducted, 30% of compliance officers said they were highly confident that they were well prepared for a HIPAA audit. The percentage of compliance officers who said they are moderately prepared for a HIPAA compliance audit has increased from 50% to 61%, showing the focus on HIPAA compliance is having a positive effect.

The study suggests the workload for compliance officers is increasing, but budgets are stagnant. Compliance officers are increasingly responsible for conducting internal audits and providing legal counsel in addition to overseeing compliance with HIPAA Privacy and Security Rules. The high workload and limited resources mean other aspects of compliance are being neglected. According to the report, “Compliance offices are being stretched thin to meet their obligations.”

While external compliance assessments are highly beneficial, only a quarter of respondents said they use independent third parties to complete those assessments, with three quarters performing self-assessments, internal surveys, and using compliance checklists to evaluate their compliance programs.

“The 2018 Healthcare Compliance Benchmark Survey gives us a better understanding of compliance program development in the healthcare sector and suggests that effectiveness is being measured in terms of output, rather than outcome,” said SAI Global CEO Peter Grana. “It is abundantly clear that there is a need for healthcare organizations to remove barriers and increased responsibilities being laid on their compliance offices that distract from the development of effective risk controls.”

About HIPAA Journal

HIPAA Journal provides the most comprehensive coverage of HIPAA news anywhere online, in addition to independent advice about HIPAA compliance and the best practices to adopt to avoid data breaches, HIPAA violations and regulatory fines. HIPAA Journal's goal is to assist HIPAA-covered entities achieve and maintain compliance with state and federal regulations governing the use, storage and disclosure of PHI and PII.